An AWS Security Bulletin has been issued concerning Strands Agents, an open-source Python SDK for AI agents. The bulletin highlights a critical vulnerability, CVE-2026-78379, within the strands-agents-tools package. Specifically, the python_repl tool, designed to execute Python code on the agent's host after operator approval, is affected. An improper neutralization of input used for LLM prompting has been identified. This flaw allows remote actors to bypass the human consent gate. They can achieve this by sending a crafted prompt through the batch tool. The batch tool can invoke multiple other tools in a single call. The crafted prompt forwards the non_interactive_mode as a keyword argument. This bypass enables the execution of arbitrary Python code on the agent's host. Versions of Strands Agents Tools prior to 0.8.5 are impacted. Users are advised to update to a version that addresses this vulnerability.